Page 5 of 7

Re: PASSWORD Security

Posted: Fri Sep 01, 2017 12:40 am
by Cainntear
Voxel wrote:
Tillumadoguenirurm wrote:Had to answer several captchas just now even though I answered correctly.

I have the same problem.

The idea with reCAPTCHA is that you generate training data that is used to teach machine learning algorithms. This means that sometimes you'll be presented with data where the correct answer isn't known, and then you might need to answer a second question to check that you're reliable and trustworthy.

Re: PASSWORD Security

Posted: Fri Sep 01, 2017 12:53 pm
by emk
I have a couple of theories about what might be going on with the CAPTCHAs. Specifically, before, our setup looked like:

Internet -> phpBB forum

Now it looks like:

Internet -> nginx reverse proxy -> phpBB forum

The problem is that the phpBB software no longer sees Internet IP addresses, but now only sees the internal IP address of the nginx proxy. Usually, this should just work transparently, because nginx sets an X-Forwarded-For header with the real IP address, which phpBB is supposed to look at. But for whatever reason, I think phpBB normally ignores this. So this means that phpBB thinks that all users of the site come from the same IP address, which it probably why it's accusing random people of too many failed logins—all failed logins seem to come from nginx.

When I have a moment, I need to Google this issue and fix either our phpBB install or possible our nginx reverse proxy configuration to get X-Forwarded-For working again. Unfortunately, it's crunch time at work, and I'm pretty busy right now.

If somebody technical has some time to look into this, or even send a pull request, I'd be massively grateful. If not, I'll try to get to it as soon as I can.

Re: PASSWORD Security

Posted: Sat Sep 02, 2017 6:40 am
by Evita
emk, is that also the reason the main page always says there's exactly one guest user online?

Re: PASSWORD Security

Posted: Sat Sep 23, 2017 4:26 pm
by Vedun
Whatever happened to this? Any progress?

Re: PASSWORD Security

Posted: Sat Oct 14, 2017 5:37 pm
by emk
Vedun wrote:Whatever happened to this? Any progress?

I'm actually working on this right now.

Re: PASSWORD Security

Posted: Wed Jan 10, 2018 8:38 pm
by Spoonary
Sorry to bring up an old issue and sound like a whiner, but these CAPTCHA questions are pretty annoying. Are we any nearer to a solution? :?

Please tell me if it's none of my business :|

Re: PASSWORD Security

Posted: Wed Jan 10, 2018 8:48 pm
by rdearman
Spoonary wrote:Sorry to bring up an old issue and sound like a whiner, but these CAPTCHA questions are pretty annoying. Are we any nearer to a solution? :?

Please tell me if it's none of my business :|

No nearer a solution I'm afraid. Nobody has time to delve into the issue.

Re: PASSWORD Security

Posted: Thu Jan 11, 2018 4:45 am
by cathrynm
The spammers are pretty persistent. I think it's just how it is.

Re: PASSWORD Security

Posted: Thu Jan 11, 2018 11:09 am
by Cainntear
Mildly annoying, but far less annoying than spammers.

Thanks to the team for implementing a working solution. Very much appreciated.

Re: PASSWORD Security

Posted: Thu Jan 11, 2018 6:31 pm
by Spoonary
Cainntear wrote:Thanks to the team for implementing a working solution. Very much appreciated.

I second this. Thanks guys! And thank you for your prompt response rdearman :)